A Safari exploit affecting the browser on both iOS and macOS has been released by security researcher Linus Henze. The exploit has been patched by Apple in iOS 12.1.1 so it is only available on devices running iOS 12.1 and lower.

This exploit can be potentially used for an iOS 12 – iOS 12.1.jailbreak, though that’s only on paper. Someone has to do the heavy lifting of actually using this exploit to create an iOS 12 – iOS 12.1 jailbreak. And since this is a Safari-based jailbreak, it can only be used to create a Safari-based jailbreak.

Want a free Safari 0day? (Ok, it’s actually a 1day because it’s fixed in the latest WebKit version, but it still works in the latest version of Safari) Then go to https://t.co/CD9IwHUQP8

This is an optimization error in the way RegEx matching is handled. By setting lastIndex on a RegEx object to a JavaScript object which has the function toString defined, you can run code although the JIT thinks that RegEx matching is side effect free.